Proof of Security of a High-Capacity Quantum Key Distribution Protocol 
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We prové the security of a high-capacity quantum key distribution protocol over noisy channels. 
By using entanglement purification protocol, we construct a modified version of the protocol in 
which we separate it into two consecutive stages. We prové their securities respectively and hence 
the security of the whole protocol. 
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I. INTRODUCTION 

Security has been one of the most important concerns 
ever since people began to communicate. Many classical 
cryptographic protocols are based on the computational 
infeasibility of some mathcmatical problems such as the 
factorization of large composite numbers, which will be 
solved in a quantum computer using Shor's algorithm[lJ. 
Quantum cryptography, on the other hand, relies on the 
principies of quantum mechanics, especially the uncer- 
tainty principle and the no-cloning theorem 2] , therefore 
is provably secure. The quantum cryptography has cap- 
tured more and more attention. It is mainly used in es- 
tablishing secrete key between two parties. The scheme is 
as follows: two participants, commonly called Alice and 
Bob, share a quantum channel. They transmit quan- 
tum states (generally refer to as qubits) which encode 
classical information, and measure the qubits in certain 
bases to get key code. Since interference introduced by 
the eavesdropper, commonly known as Eve, will disturb 
quantum states and can be detected, Alice and Bob will 
share their mcssagcs while lcaking little information to 
Eve. Many quantum key distribution protocols (QKD) 
have been proposed since the first protocohS] published 
by Bennet and Brassard, for instance in protocols in Refs. 

aaiaiJMiïa. 

Security and efRciency are two principal factors in 
QKD protocols. Since both the channel noise and eaves- 
dropping can disturb the quantum states, a good defini- 
tion of security requires a distinct differentiation between 
them. One parameter of security serves this purpose. 
Denoted as the tolerable bit error rate, it is defined as 
follows: below this threshold, a QKD is secure by us- 
ing quantum error correction and privacy amplification. 
The fast development of QKD protocols requires explicit 
proof of their securities over noisy channels. Mavers'sp^ 
and Biham's0| work reach this end by complex cal- 
culation. A different approach, by using entanglement 
purification protocols (EPP) which can purify the EPR 
pairs by sacrificing some of them[T3|. was proposed[Ï5||. 
After that. many proofs with this bàsic idea have been 

givenlíUfLUlGj. 

Efnciency is also an important parameter of QKD pro- 



tocols. In this paper, we will concentrate on a theoret- 
ically high-capacity QKD protocol^- Its efnciency is 
achieved by adopting EPR pair which encodes 2 classical 
bits. 

The high-capacity protocol transmits an EPR sequence 
in two steps, one particle sequence at a time, thus is pro- 
tected against eavesdropping in ideal quantum channel 
(that is, channel without noise). In ordcr to make it 
error-resistant in noisy quantum channels, we apply the 
method of Shor and Preskill 16] and add an EPP to the 
protocol to construct a modified version so as to prové 
its security. Our paper is organized as follows: in section 
Ull we specify the notations used in this paper. In sec- 
tion lIIII we briefly review the high-capacity protocol and 
outline the proof of security in ideal situations. In sec- 
tion HYI we add security check procedures to the original 
protocol and prové the first stage of the modified version 
is secure. In section we prové the security of the sec- 
ond stage of the modified high-capacity protocol. Then 
we prové that this modified version is equivalent to the 
original one and give a brief summary in section IVII 



II. NOTATION 

The notations used here are mostly the same as that 
of the high-capacity protocol^ and that of the Shor and 
PreskilTs|lf|. 

Bell bases are the four maximally entangled states: 

= -Lfloo) ± |ii», = i(|oi) ± |io». (i) 

We use |$+), |$~), |*+) and |* _ ) to represent 00, 01, 
10 and 11 respectively. 

The three Pauli matrices are: 



1 

1 



-i 
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-1 



They are used in the error checking process. 
The Hadamard transform, H, is of the form: 



(2) 



(3) 
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It interchanges the basis |0), |1) and |+), |— ), where 
1+) = ^(|0) + |1» and |-) = ^(|0) - |1)). In what 
we will see in section IIVI after randomly performs the 
Hadamard gate, bit flip errors and phase flip errors would 
be uncorrelated. 

We introduce the Calderbank-Shor-Steane(CSS) code 
in the entanglement purification process, a CSS code|l6| 
is defined as follows: C% and C 2 are two classical binary 
codes which satisfy 

{0} C C 2 C d C P 2 " (4) 

where F 2 is the binary space of n bits. C\ and C 2 can 
correct up to t bit errors. A basis of the CSS code can 
be built as follows, for v £ Ci, define the vector 

Notice that when v% — v 2 C C 2 , they give the same code. 
So the CSS code corresponds to the coset of C 2 in C\. 
Let Hi and H 2 be the parity check matrix for the code 
Ci and C 2 respectively. Then by measuring for each 
row r £ H\ and a x for each row r £ H 2 , the CSS code 
can correct up to t bit errors. 

III. REVIEW OF THE HIGH-CAPACITY 
PROTOCOL 



5. (First eavesdropping check.) After hearing from 
Bob, Alice then performs measurement on the part- 
ner subset of those partides whose partner has been 
measured by Bob. They then publicly compare 
their results of these measurements to check eaves- 
dropping. 

6. If they are certain that there is no eavesdropping, 
then Alice sends Bob the remaining EPR particle 
sequence: [P x {\), P 2 (I), . . ., P N {1)}. 

7. After Bob receives these N partides, he first drops 
the partides that have been measured, then takes 
one particle from each particle sequence in order 
and performs Bell-basis measurement on them. He 
records the results of the measurements. 

8. (Second eavesdropping check.) Alice and Bob 
choose a sufficiently large subset of these Bell-basis 
measurement results to determine if the QKD is 
successful. If the error rate in this check is below a 
certain threshold, then the results are taken as raw 
key. 

Unlike many other QKD protocols 0, H @, in which 
an EPR pair is used to encode one key bit, the high- 
capacity protocol here encodes two bits, thus the capacity 
is doubled. 

As discussed in the original paper 0, this protocol is 
secure in quantum channels without noise. 



The key point of the high-capacity protocol is that it 
uses each EPR pair to encode 2 bits of key code. By 
building an ordered EPR sequence and sending each half 
in two steps from Alice to Bob, Alice and Bob can protect 
their communication against most eavesdropping attacks. 
Here we outline the high-capacity protocol U- 
Protocol 1: Theoretical efficient high-capacity Protocol 

1. Alice produces an ordered N EPR pair sequence: 
[(^(1), P(2)), (P 2 (l), P 2 (2)), (P(l), P(2)), 
...,(P N (1),P N {2))]. 

2. Then Alice takes one particle from each EPR pair 
to form two ordered EPR partner particle se- 
quences: [Pi(l), P 2 (l), . . ., P N (1)] and [P x (2), 
P 2 (2), . . ., P/v (2)]. Alice sends to Bob one ordered 
EPR partner particle sequence: [Pi (2), P 2 (2), . . ., 
Pn(2)}. 

3. After Bob receiving the ordered EPR partner par- 
ticle sequence, randomly he chooses a sufficiently 
large subset of his sequence and performs measure- 
ment on the partides in the subset randomly in of 
the two measuring-basis o~ z or o~ x . The result of this 
measurement will be either or 1. Bob stores the 
rest of the partides of his EPR particle sequence. 

4. Then Bob telis Alice through a classical channel his 
reception of the particle sequence and the partides 
that he has chosen to measure in a certain direction. 



IV. THE FIRST STAGE OF THE MODIFIED 
HIGH-CAPACITY PROTOCOL 

From the review of the high-capacity protocol, we see 
that it is an efficient protocol, but a critical qüestions 
remains: how can this protocol protect against quantum 
channel noise? In other words, how can Bob distinguish 
between channel noise and eavesdropping, and can cor- 
rect bit errors when necessary? 

In this section, we add entanglement purification steps 
to the first stage of the high-capacity protocol and prové 
its security over noisy channels. 

Protocol 2: Secure high-capacity Protocol(stage 1) 

1. Alice produces an ordered N EPR pair sequence 
according to a quaternary string a. More specifi- 
cally, she creates |$ + ), |$~), \^ + ) or |*~) when 
the corresponding = 0,1,2 or 3. Thus build 
[(P(I), P X (2)), (P 2 (I), P 2 (2)), (P(l), P(2)), 

(P N (1), Pv(2))]. 

2. Then Alice takes one particle from each EPR pair 
to form two ordered EPR partner particle se- 
quences: [Pi(I), P 2 (l), . . ., P N (1)] and [Pi(2), 
P 2 (2), . . ., P/v (2)]. She retains the first sequence. 

3. Alice randomly chooses the bases of the second half 
of the EPR pairs. More specifically, Alice seleets a 
random N binary string b and applies Hadamard 
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transformation on -Pi (2) when the corresponding 
ith bit is 1. 

4. Alice sends the second EPR sequence to Bob. 

5. Bob receives the N qubits and publicly announces 
the reception. 

6. Alice randomly chooses n(n < N) bits as checking 
bits and leaves the rest N — n bits unchanged. 

7. Alice then telis Bob the bit string b and which n 
bits are checking bits. 

8. Bob performs Hadamard transformation on the 
qubits where the corresponding components of a 
are 1. They measure the n checking qubits in 
|0), |1) bases, if too many outcomes disagree, they 
abort the protocol. 

9. Alice and Bob applies a CSS code and makes a z 

[r'l 

according to each row r € H\ and a x according 
to each row r' <E H2 to their EPR partides. They 
compute the syndromes and make corrections in 
order that they obtain k(k < N — n) nearly perfect 
EPR pairs. 

The above protocol is the first stage of the modified 
version of the high-capacity protocol. We employ CSS 
code here to purify the entangled states. Notice that the 
vector space C\ and C^r are orthogonal, so 0$ and 0% ' 
commutes. The measurement computes the error syn- 
drome for bit flip and phasc flip respectively, then after 
the measurement, Alice and Bob can obtain k perfect 
EPR pairs. 

We next show that the bit and phase errors are un- 
correlated. As noted by Lo and Chau0, for a quantum 
channel, the error rate can be expressed by a density ma- 
trix diag(a,b, c, d), in which a, ò, c and d represent the 
probabilities of zero errors, bit flip errors, phase flip errors 
and both bit and phase flip errors. As noted in sectionlïïl 
the Hadamard transformation interchanges the basis |0), 
|1) and |+), |— ), so it changes bit flip error to phase flip 
error and vice versa. When N is large enough, there is 
a high probability to have ^ 1 in the binary string b, so 
there are almost half Hadamard transforms operating on 
the EPR pairs. Averaging over the two cases of Identity 
and Hadamard, the effective density matrix shared by 
Alice and Bob after the operation is diag(a, ^p, d). 
From this matrix, we can see that the Hadamard trans- 
formation makes the bit flip error and the phasc flip error 
with equal probability and uncorrelated. 

Because this modified high-capacity protocol uses CSS 
code, it can successfully correct quantum state which dif- 
fers from the input state (we denoted as \ip}) less than 
t bit flip errors and t phase flip errors. Since all the 
measurements in this protocol commute under the Bell 
states, we can use the classical method to calculate the 
fidelity of the purified k EPR pairs. In the transmission, 



the error rates for the check bits and code bits are al- 
most the same. And because Eve doesn't know anything 
about the check bits and the code bits, her interference is 
also the same to these two sets. Then as (N — n) — > 00, 
we can use classical probability theory to calculate the 
fidelity, which will yield F(p, ip) > 1 - 2~ s . 

Applying the Lemma 1 and 2 of Lo and Chau^Ü > we 
know that if Alice and Bob share a state with fidelity 
greater than 1 — 2~ s with input state p, then Eve's mutual 
information with the key would be exponcntially small, so 
the first stage of the modified version of the high-capacity 
protocol is safe. 



V. THE SECOND STAGE OF THE MODIFIED 
HIGH-CAPACITY PROTOCOL 

In this section, we prové that the second stage of the 
protocol is secure too. This stage can be seen as a repe- 
tition of the first stage, with a some variation as we list 
below. 

Protocol 2: Secure high-capacity Protocol(stage 2) 

10. Alice has one ordered half of k perfect EPR particle 
sequence: [P{ (1), P^(l ),..., P^(l)] and Bob has the 
corresponding sequence: [P[(2), P^), . . ., P' k (2)\. 

11. Alice randomly chooses the bases of her own halves 
of the EPR pairs. To be more specific, Alice selects 
a random k binary string 6' and applies Hadamard 
gates on Pi(l) when the corresponding ith bit is 1. 

12. Alice sends her EPR sequence to Bob. 

13. After receiving the sequence, Bob publicly an- 
nounces this fact. 

14. Alice then telis Bob the binary string b' . 

15. Bob selects a sufficiently large subset among his 
EPR pairs and measures them according to b' , if 
too many results inconsistent, he aborts the com- 
munication. 

16. Bob performs entanglement purification in the 
same way as in stage 1 to the remaining EPR pairs 
to obtain m perfect EPR pairs. 

17. Bob performs Bell-basis measurement to obtain the 
secret key. 

The proof of security of the stage 2 of protocol 2 is 
similar to that of stage 1. So as discussed above, Eve can 
know nothing about the pure EPR pairs in Bob's hand, 
then it is obvious that stage 2 is also unconditionally 
secure. 

Combining the previous two stages together, we will 
see that by adding entanglement purification protocol to 
the high-capacity protocol will protect it against quan- 
tum channel noise. 
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VI. CONCLUSION AND FURTHER 
DISCUSSION 

We have given the security proof of the high-capacity 
QKD protocol by using the Shor-Preskill method. The 
proof is divided into two stages. When the error rate is 
below the threshold value, 11% for the one-way commu- 
nication protocol as is true in our case, Alice and Bob 
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